envr/TODOS.md

TODO

Note: These todos can wait until all the subcommands have been ported.

HIGH

2. db.odin:380-383, 405, 446 — sqlite.bind_text return values overwritten but never checked. A failed bind means sqlite.step operates on unbound params.

3. config.odin:52-54 — os.user_home_dir error silently ignored. If it fails, home is "" and all paths become relative (".envr" instead of "~/.envr").

MEDIUM

4. db.odin:29-35 — make_temp_path never calls strings.builder_destroy. Leaks builder buffer every call.

5. db.odin:324-327 — Map iteration (remote_set) is non-deterministic. Same file can produce different JSON on each backup, causing spurious DB diffs. Sort remotes before storing.

6. db.odin:470-473 — string_to_cstring allocates via strings.clone_to_cstring and never frees. Called dozens of times across db operations.

7. db.odin:470, 462 — Both string_to_cstring and cstring_to_string ignore allocation errors. A nil cstring gets passed to SQLite (UB).

8. db.odin:135, 250 — String interpolation into SQL (VACUUM INTO '%s', ATTACH DATABASE '%s'). Currently safe because input is controlled, but fragile.

9. features.odin:30-41 — find_binary uses strings.join instead of filepath.join, uses os.stat instead of checking executability, hardcodes : as PATH separator (wrong on Windows).

10. cmd_restore.odin:20-30 & cmd_remove.odin:19-29 — Identical path-resolution block copy-pasted. is_abs guard is redundant since filepath.abs is a no-op on absolute paths. Extract a helper.

11. cmd_restore.odin:44 — os.mkdir_all error silently discarded. Subsequent write failure will be confusing.

12. cmd_edit_config.odin:27 — $EDITOR used as single binary name. Breaks for multi-word values like "code -w". Needs strings.fields().

13. config.odin:178 — search_paths silently ignores os.user_home_dir error. If home is empty, ~ isn't expanded. Same class of bug as issue 3.

14. prompt.odin:124 — make([dynamic]bool, len(options)) creates N zero-initialized elements. Works because false is the default, but same footgun as original issue 1. Should be make([dynamic]bool, 0, len(options)).

15. Lots of memory leaks to fix.

LOW

15. db.odin:115 — json.unmarshal_string error not checked. Malformed JSON silently produces empty/partial data.

16. db.odin:352-353 — hex.encode error ignored. string(hex_bytes) aliases the byte slice.

17. config.odin:51-60 — envr_dir recomputes home dir on every call. Could cache.

18. cmd_sync.odin:80, cmd_list.odin:33, cmd_deps.odin:9 — make([]string, 2) for table rows never freed. Leaks per row. Defer to memory pass.

REFACTOR

20. cmd_list.odin — Non-TTY branch builds ListEntry structs and marshals JSON separately. Now that render_json_rows (issue 1) accepts an io.Writer and uses json.marshal, unify both branches to use it. Note: will change JSON keys from "directory"/"path" to "Directory"/"Path".

21. Check for prealloc opportunities. i.e. make([dynamic]string) -> make([dynamic]string, 5).

22. Add a text filter to the multi_select.

23. Create backup / fallback fd.

24. Add tests for untested commands.

25. Add a global --config -c flag to use an alternate config.

26. version --long Odin only prints version; Go also prints commit hash and build date

27. 2 scan tests silently skip Low When fd isn't installed, tests pass without actually testing anything. These should use #assert to be sure that fd is in path.

28. Try to do all encryption / decryption in memory - only read / write encrypted data to disk.

29. use a buffered writer where possible (mem.DEFAULT_PAGE_SIZE)

Double-check AI output

• cli.odin
• cli_test.odin
• cmd_backup.odin
• cmd_check.odin
• cmd_check_test.odin
• cmd_deps.odin
• cmd_edit_config.odin
• cmd_init.odin
• cmd_list.odin
• cmd_list_test.odin
• cmd_nushell_completion.odin
• cmd_nushell_completion_test.odin
• cmd_remove.odin
• cmd_restore.odin
• cmd_scan.odin
• cmd_sync.odin
• cmd_version.odin
• config.odin
• config_test.odin
• crypto.odin
• crypto_test.odin
• db.odin
• db_integration_test.odin
• db_test.odin
• features.odin
• features_test.odin
• main.odin
• prompt.odin
• scan.odin
• scan_test.odin
• sodium.odin
• sqlite/sqlite.odin
• ssh.odin
• ssh_test.odin
• table.odin
• table_test.odin